Proposal: Add Namespaced Cloud, Identity, and SaaS Platforms
Author: cyberbuffCreated Jul 20, 2026Updated Aug 24, 2026
Use-cases
Atomic Red Team is adding more cloud, identity, and SaaS-focused tests. A flat supported_platforms value such as saas does not give enough detail once tests need to target Slack, Teams, Snowflake, Microsoft 365, Google Workspace, Entra ID, Okta, and other services.
More specific platform identifiers would help contributors and users:
- filter atomics by the actual service being tested
- distinguish identity-provider behavior from SaaS application behavior
- generate clearer platform indexes and ATT&CK Navigator layers
- avoid grouping unrelated SaaS tests under one broad
saasbucket - keep naming consistent with existing namespaced values such as
iaas:aws,iaas:azure, andiaas:gcp
Proposal
Add namespaced supported_platforms values for cloud identity providers and SaaS applications.
Suggested format:
<category>:<service>Suggested categories:
idp
saas
iaasSuggested initial platform updates:
| Current value | Proposed value | Notes |
|---|---|---|
azure-ad |
idp:entra |
Azure AD is now Microsoft Entra ID and should be treated as the Microsoft identity platform. |
google-workspace |
idp:google-workspace |
For tests focused on Google identity, users, groups, auth, SSO, delegation, or admin identity controls. |
| N/A | idp:okta |
For tests focused on Okta identity, users, groups, auth, SSO, federation, or admin identity controls. |
office-365 |
saas:office-365 or saas:microsoft-365 |
Office 365 / Microsoft 365 is SaaS, not an IdP. Identity-focused Microsoft tests should use idp:entra. |
saas |
service-specific saas:* values where possible |
Keep generic saas only for tests that are truly service-agnostic. |
Suggested new SaaS values:
saas:slack
saas:teams
saas:snowflake
saas:office-365References
Source: redcanaryco/atomic-red-team